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31 May 2022 


The Chief Executive 
All Authorized Institutions 


Dear Sir / Madam, 


Supervisory Policy Manual (SPM): New module OR-2 on “Operational 





Resilience” and revised module TM-G-2 on “Business Continuity Planning” 


I am writing to inform you that, following consultation with the industry, the 
Monetary Authority issued today a new SPM module OR-2 on “Operational 
Resilience” and a revised version of the SPM module TM-G-2 on “Business 
Continuity Planning”. 


New SPM module OR-2 and revised SPM module TM-G-2 


The modules serve to implement the Basel Committee on Banking Supervision 
(BCBS)’s Principles for Operational Resilience (POR) issued in March 2021. 
Specifically: 


e The new OR-2 module, issued as a guidance note, specifies the HKMA’s overall 
approach to operational resilience. It sets out the HKMA’s expectation that every 
Authorized Institution (AI) should be operationally resilient, and provides high- 
level guidance on how Als can develop an integrated and holistic operational 
resilience framework to support this. 


e The revised TM-G-2 complements OR-2 by providing enhanced guidance on 
business continuity planning, which is a key component of an effective 
operational resilience framework. It incorporates additional requirements related 
to business continuity planning and testing covered within the POR, and also 
aligns the terminology used for business continuity planning and operational 
resilience purposes to enhance clarity. 


Als should note that many of the concepts and requirements related to operational 
resilience are not new and are already covered extensively under existing HKMA 
guidance. AIs should therefore refer to relevant SPM modules when implementing 
the requirements of OR-2. Besides the revised TM-G-2, these also include SA-2 on 
“Outsourcing” and the forthcoming revised OR-1l on “Operational Risk 
Management”, which is being refined having regard to comments received from the 
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industry, and will amongst others, reflect those requirements related to operational 
risk management contained within the POR. 


Implementation timeline 


After factoring in industry feedback, and as detailed within the OR-2 module, the 
HKMaA will expect every AI to have: 


(1) developed its operational resilience framework and determined the timeline 
by which it will become operationally resilient, within 1 year after the final 
OR-2 module is issued (i.e. 31 May 2023); and 


(41) | become operationally resilient as soon as their circumstances allow and no 


later than 3 years after the initial 1-year planning period (i.e. no later than 
31 May 2026). 


The above timeline applies to all new requirements related to operational resilience, 
including those contained in the revised TM-G-2 and the revised OR-1. An AI should 
therefore be compliant with those requirements relating to the development of its 
operational resilience framework by 31 May 2023, and those relating to the 
implementation of the framework no later than 31 May 2026. 


Should you have any questions regarding the above, please contact Ms Joanna Chan 
on 2878 8694 or Ms Joyce Cheung on 2878 1494. 


Yours faithfully, 


Raymond Chan 
Executive Director (Banking Supervision) 


Encl 
C.C. The Chairperson, The Hong Kong Association of Banks 


The Chairperson, The DTC Association 
FSTB (Attn: Mr Justin To) 


